CVE-2026-110861

The Better Auth library, specifically the @better-auth/drizzle-adapter (versions 1.6.17 to 1.7.7), better-auth (versions 1.6.17 to 1.7.7), and @better-auth/kysely-adapter (versions 1.6.17 to 1.7.0), contains a race condition in its database-backed rate limiting when used with PostgreSQL . The roo...

CVE-2026-110861 Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition

Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-adapter from 1.6.17 before 1.7.0, contain a race condition in database-backed rate limiting on PostgreSQL where the limit check is not atomic with the counter update. Remote attackers can se...

CVE-2026-110861 Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition

Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-adapter from 1.6.17 before 1.7.0, contain a race condition in database-backed rate limiting on PostgreSQL where the limit check is not atomic with the counter update. Remote attackers can se...

PT-2026-114175

Name of the Vulnerable Software and Affected Versions better-auth versions 1.6.17 through 1.7.6 @better-auth/drizzle-adapter versions 1.6.17 through 1.7.6 @better-auth/kysely-adapter versions 1.6.17 through 1.6.9 Description A race condition exists in database-backed rate limiting on PostgreSQL...

@adenta/cms (>=0.0.6, <=1.1.1-0), @ainsleydev/payload-helper (>=0.0.6, <=0.3.2) +35 more potentially affected by CVE-2026-105866 via @payloadcms/drizzle (>=3.0.0-beta.74, <=3.89.0)

@payloadcms/drizzle NPM version =3.0.0-beta.74, =0.0.6, =0.0.6, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =3.22.1, =3.37.0, =1.0.0, =1.2.0 and more Source cves: CVE-2026-105866 Source advisory: SNYK:JS-PAYLOADCMSDRIZZLE-20570507...

Overly Restrictive Account Lockout Mechanism

Overview @payloadcms/drizzle is an A library of shared functions used by different payload database adapters Affected versions of this package are vulnerable to Overly Restrictive Account Lockout Mechanism via the resetPassword operation, which fails to reset the account lockout state upon a...

@payloadcms/db-d1-sqlite (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/db-postgres (>=4.0.0-canary.0, <=4.0.0-canary.33) +2 more potentially affected by CVE-2026-105866 via @payloadcms/drizzle (>=4.0.0-canary.0, <=4.0.0-canary.33)

@payloadcms/drizzle NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105866 Source advisory: SNYK:JS-PAYLOADCMSDRIZZLE-20570507...

@adenta/cms (>=0.0.6, <=1.1.1-0), @ainsleydev/payload-helper (>=0.0.25, <=0.3.2) +35 more potentially affected by CVE-2026-105856 via @payloadcms/drizzle (>=3.0.0, <=3.89.0)

@payloadcms/drizzle NPM version =3.0.0, =0.0.6, =0.0.25, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =3.22.1, =3.37.0, =1.0.0, =1.2.0 and more Source cves: CVE-2026-105856 Source advisory: MEND:CVE-2026-105856...

@payloadcms/db-d1-sqlite (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/db-postgres (>=4.0.0-canary.0, <=4.0.0-canary.33) +2 more potentially affected by CVE-2026-105856 via @payloadcms/drizzle (>=4.0.0-canary.0, <=4.0.0-canary.33)

@payloadcms/drizzle NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105856 Source advisory: MEND:CVE-2026-105856...

Missing Authorization

Overview @payloadcms/drizzle is an A library of shared functions used by different payload database adapters Affected versions of this package are vulnerable to Missing Authorization via the contains query operator on relationship, upload, and join fields, where access control filters injected fo...

@adenta/cms (>=0.0.6, <=1.1.1-0), @ainsleydev/payload-helper (>=0.0.6, <=0.3.2) +35 more potentially affected by CVE-2026-105852 via @payloadcms/drizzle (>=3.0.0-beta.74, <=3.89.0)

@payloadcms/drizzle NPM version =3.0.0-beta.74, =0.0.6, =0.0.6, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =3.22.1, =3.37.0, =1.0.0, =1.2.0 and more Source cves: CVE-2026-105852 Source advisory: SNYK:JS-PAYLOADCMSDRIZZLE-20571386...

@payloadcms/db-d1-sqlite (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/db-postgres (>=4.0.0-canary.0, <=4.0.0-canary.33) +2 more potentially affected by CVE-2026-105852 via @payloadcms/drizzle (>=4.0.0-canary.0, <=4.0.0-canary.33)

@payloadcms/drizzle NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105852 Source advisory: SNYK:JS-PAYLOADCMSDRIZZLE-20571386...

Payload CMS 3.72.0 SQL Injection

Payload CMS version 3.72.0 suffers from a remote blind SQL injection vulnerability. Exploit Title: Payload CMS 3.72.0 - Blind SQL Injection Google Dork: N/A Date: 2026-08-01 Exploit Author: cardosource Vendor Homepage: https://payloadcms.com/ Software Link: https://github.com/payloadcms/payload...

Payload CMS 3.72.0 - Blind SQL Injection

Exploit Title: Payload CMS 3.72.0 - Blind SQL Injection Google Dork: N/A Date: 2026-08-01 Exploit Author: cardosource Vendor Homepage: https://payloadcms.com/ Software Link: https://github.com/payloadcms/payload Version: requests.Response: url: str = "http://localhost:3000/api/posts"...

Drizzle / Prisma Schema Exposure Detection

Probes for exposed prisma/schema.prisma, migration SQL, drizzle.config.ts, drizzle/meta/journal.json, and db/schema.ts files leaking full DB schemas. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed Drizzle ORM and Prisma schema/migration artifacts.""" from kittysploit import from...

CVE-2026-39356

Drizzle is a modern TypeScript ORM. Prior to 0.45.2 and 1.0.0-beta.20, Drizzle ORM improperly escaped quoted SQL identifiers in its dialect-specific escapeName implementations. In affected versions, embedded identifier delimiters were not escaped before the identifier was wrapped in quotes or...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code containing a malicious binding.gyp file that drops and runs a self-propagating cloud secret stealer. The malicious code attempts to exfiltrate AWS, GCP, Azure, Vault, and Kubernetes credentials, as well as npm an...

Drizzle ORM has SQL injection via improperly escaped SQL identifiers

Summary Drizzle ORM improperly escaped quoted SQL identifiers in its dialect-specific escapeName implementations. In affected versions, embedded identifier delimiters were not escaped before the identifier was wrapped in quotes or backticks. As a result, applications that pass attacker-controlled...

pothos-drizzle-generator (>=0.0.1, <=0.1.0) potentially affected by CVE-2026-39356 via drizzle-orm (1.0.0-beta.2-f9236e3)

drizzle-orm NPM version 1.0.0-beta.2-f9236e3 is affected by a known vulnerability. The following packages have a transitive dependency on drizzle-orm and may be impacted: - pothos-drizzle-generator =0.0.1, =0.1.0 Source cves: CVE-2026-39356 Source advisory: SNYK:JS-DRIZZLEORM-16000009...

0xble (>=21.4.1, <=22.1.2), @10xsai/ts-serverless (>=0.1.0, <=0.1.1) +1760 more potentially affected by CVE-2026-39356 via drizzle-orm (>=0.37.0, <=0.45.1)

drizzle-orm NPM version =0.37.0, =21.4.1, =0.1.0, =0.1.1, =0.1.1, =0.1.1, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =1.0.0, =0.1.0, =0.22.5, =0.1.0, =0.0.1, =1.0.0, =1.0.1 and more Source cves: CVE-2026-39356 Source advisory: SNYK:JS-DRIZZLEORM-16000009...